npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 491
Updated 24 Oct 2026, 09:10 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5785 blocks this version. On `npm install`, the package's preinstall lifecycle invokes postinstall.js, which collects hostname, username, and current...
OpenSSF/OSV malware advisory MAL-2026-5783 blocks this version. On `npm install`, the package's preinstall hook (`preinstall: node postinstall.js || true`) executes postinstall.js, which...
OpenSSF/OSV malware advisory MAL-2026-5784 blocks this version. On `npm install`, the package's preinstall hook (`node postinstall.js || true`) executes automatically. The script collects...
OpenSSF/OSV malware advisory MAL-2026-5782 blocks this version. On `npm install`, the preinstall lifecycle script in postinstall.js enumerates process.env, filters keys matching a broad c...
OpenSSF/OSV malware advisory MAL-2026-5781 blocks this version. On `npm install`, the package's `preinstall` hook executes `postinstall.js`, which enumerates `process.env` and filters key...
OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...
OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...
OpenSSF/OSV malware advisory MAL-2026-5790 blocks this version. ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The packag...
OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...
OpenSSF/OSV malware advisory MAL-2026-5838 blocks this version. On require, index.js performs an unconditional `http.get` to a unique subdomain of oastify.com (Burp Suite Collaborator out...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5772 blocks this version. The package's only code file (index.js, also registered as the package's bin entry) unconditionally executes `require('chil...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5767 blocks this version. ltidiconf@99.9.1 is an empty wrapper package (index.js is `module.exports = {};`, empty author/description, inflated 99.9.1...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5922 blocks this version. The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto...
OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...
OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...
OpenSSF/OSV malware advisory MAL-2026-6311 blocks this version. @thymelab/logfx (malicious version 2.15.5, published by thymelab-v0et8w@wshu.net) is a trojanized npm package belonging to...
OpenSSF/OSV malware advisory MAL-2026-6310 blocks this version. @petitcode/eb-retry (malicious version 1.3.5, published by petitcode-eq1efk@wshu.net) is a trojanized npm package belonging...
OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...
OpenSSF/OSV malware advisory MAL-2026-6307 blocks this version. @glitchpad/throttler (malicious version 2.2.3, published by glitchpad-revqgz@wshu.net) is a trojanized npm package belongin...